Comment by moyix | Hacker News Reader

Comment by moyix | Hacker News Reader

Parent Full thread

I'd like to offer a different perspective. You're free to dismiss me as well because I currently have a similar job description to 'djcapelis, but I've also been a sysadmin and front-line IT security guy (watching IDSes, patching systems), so I have a pretty good idea what the commoditization of exploit code means.

I think that things like metasploit and heartleech are an almost purely unalloyed good. In my experience, the "bad guys" already have easy-to-use tools. What publicly available tools do is give defenders access to these techniques, which they can use to demonstrate that problems really are a Big Deal. There is a certain kind of person (who seem to gravitate towards management) that cannot be convinced to take an issue seriously unless they can see the impact with their own eyes. A tool that prints out the private key of their production server is worth a dozen blog posts and security advisories as far as convincing them the danger is real.

Yup.

Getting a private key using the extent simple scrypts is quite complicated, with lots of difficult steps. This is no barrier to teenage kids, who has lots of time on their hands that can play around until they get things right.

As a defender, however, you don't have that much time. For you, it's really easy. If you have a server, and want to know if the private key is visible, just download the Windows heartleech binary from github, run it against a server, walk away for 10 hours, and then come back to see if it's gotten the key.

In short, as you say, a tool that effortlessly prints the private key of a production server is worth a bazillion blogposts and security advisories. Code or GTFO, IMO :)

Exactly, how many people didn't really care about unencrypted requests over public WiFi networks until everyone and their grandson could install Firesheep? Tools to make that attack had been available forever, but only after Firesheep did many people finally accept that basically any authenticated request should be done over a secure channel.

For a huge majority of folks, some unfortunately in the position of making decisions and policy surrounding security, the attack just isn't real until there's a nicely usable and widely available tool.

Reply on news.ycombinator.com